fix(security): Enforce isAuthenticated across new settings and skills routes

src/app/api/settings/lkgp-cache/route.ts

@@ -1,7 +1,11 @@
 import { NextResponse } from "next/server";
 import { clearAllLKGP } from "@/lib/db/settings";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
 
-export async function DELETE() {
+export async function DELETE(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
   try {
     clearAllLKGP();
     return NextResponse.json({ cleared: true });

src/app/api/settings/purge-logs/route.ts

@@ -1,8 +1,12 @@
 import { NextResponse } from "next/server";
 import { getDbInstance } from "@/lib/db/core";
 import { getCallLogRetentionDays } from "@/lib/logEnv";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
 
-export async function POST() {
+export async function POST(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
   try {
     const db = getDbInstance();
     const retentionMs = getCallLogRetentionDays() * 24 * 60 * 60 * 1000;

src/app/api/skills/executions/route.ts

@@ -1,7 +1,10 @@
 import { NextResponse } from "next/server";
 import { skillExecutor } from "@/lib/skills/executor";
 
-export async function GET() {
+export async function GET(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
   try {
     const executions = skillExecutor.listExecutions();
     return NextResponse.json({ executions });
@@ -11,14 +14,28 @@ export async function GET() {
   }
 }
 
-export async function POST(request: Request) {
-  try {
-    const body = await request.json();
-    const { skillName, input, apiKeyId, sessionId } = body;
+import { z } from "zod";
+import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
 
-    if (!skillName || !apiKeyId) {
-      return NextResponse.json({ error: "skillName and apiKeyId are required" }, { status: 400 });
+const executionSchema = z.object({
+  skillName: z.string().min(1),
+  apiKeyId: z.string().min(1),
+  input: z.record(z.unknown()).optional(),
+  sessionId: z.string().optional(),
+});
+
+export async function POST(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  try {
+    const rawBody = await request.json();
+    const validation = validateBody(executionSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return validation.response;
     }
+    const { skillName, input, apiKeyId, sessionId } = validation.data;
 
     const execution = await skillExecutor.execute(skillName, input || {}, {
       apiKeyId,

src/app/api/skills/marketplace/install/route.ts

@@ -3,6 +3,8 @@ import { z } from "zod";
 import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
 import { skillRegistry } from "@/lib/skills/registry";
 
+import { isAuthenticated } from "@/shared/utils/apiAuth";
+
 const marketplaceInstallSchema = z.object({
   name: z.string().min(1).max(64),
   description: z.string().min(1).max(1024),
@@ -12,6 +14,9 @@ const marketplaceInstallSchema = z.object({
 });
 
 export async function POST(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
   try {
     const rawBody = await request.json();
     const validation = validateBody(marketplaceInstallSchema, rawBody);

src/app/api/skills/marketplace/route.ts

@@ -1,7 +1,11 @@
 import { NextResponse } from "next/server";
 import { getSettings } from "@/lib/db/settings";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
 
 export async function GET(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
   try {
     const { searchParams } = new URL(request.url);
     const q = searchParams.get("q") || "";

src/i18n/messages/en.json

@@ -2250,7 +2250,9 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "days": "Days",
     "lkgp": "LKGP Mode",
-    "lkgpDesc": "Last Known Good Provider (Predictable resilience)"
+    "lkgpDesc": "Last Known Good Provider (Predictable resilience)",
+    "purgeExpiredLogs": "Purge Expired Logs",
+    "purgeLogsFailed": "Failed to purge logs"
   },
   "translator": {
     "title": "Translator",

src/i18n/messages/pt-BR.json

@@ -2248,7 +2248,9 @@
     "skillsEnabledDesc": "Permite aos agentes executar consultas e gerar arquivos.",
     "skillsComingSoon": "Marketplace em breve.",
     "memorySkillsTitle": "Memória e Skills",
-    "memorySkillsDesc": "Contexto persistente e capacidades A2A"
+    "memorySkillsDesc": "Contexto persistente e capacidades A2A",
+    "purgeExpiredLogs": "Purgar Logs Expirados",
+    "purgeLogsFailed": "Falha ao purgar logs"
   },
   "translator": {
     "title": "Tradutor",

src/i18n/messages/pt.json

@@ -2248,7 +2248,9 @@
     "skillsEnabledDesc": "Permite aos agentes executar consultas e gerar arquivos.",
     "skillsComingSoon": "Marketplace em breve.",
     "memorySkillsTitle": "Memória e Skills",
-    "memorySkillsDesc": "Contexto persistente e capacidades A2A"
+    "memorySkillsDesc": "Contexto persistente e capacidades A2A",
+    "purgeExpiredLogs": "Purgar Logs Expirados",
+    "purgeLogsFailed": "Falha ao purgar logs"
   },
   "translator": {
     "title": "Tradutor",